Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
48 detections
Filters
Last updated
All Time
Detection languages
20
15
9
2
1
Contributors
13
8
8
7
4
Categories
15
11
10
8
7
Platforms
40
8
4
2
2
Products / Services
14
10
7
5
4
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
Detects specific process creation patterns associated with UNC2452 (SolarWinds Compromise) activity, as identified by Microsoft Defender ATP queries. This includes the use of 7-Zip for archiving, wscript.exe executing VBS scripts, and rundll32.exe for DLL execution, often involving specific command-line arguments and parent-child relationships.
Detects command-line indicators associated with the APT29 (Cozy Bear) 2018 phishing campaign, specifically looking for PowerShell execution with '-noni -ep bypass' and the presence of 'cyzfc.dat' and 'PointFunctionCall' in the command line. These indicators are linked to the group's methods for executing malicious code and potentially bypassing security measures.
Detects a specific PowerShell command line pattern used by the UNC2452 threat group (also known as APT29 or Nobelium) for execution. The rule looks for PowerShell commands that use 'Invoke-WMIMethod win32_process -name create -argumentlist' or 'wmic /node: process call create' in conjunction with 'rundll32 c:\windows'. This pattern was observed in the SolarWinds Compromise.
Detects attempts to download executable files via WebDAV. This activity has been observed in campaigns attributed to APT29, where adversaries leverage WebDAV to transfer malicious tools into a compromised environment.
Detects file indicators associated with a 2018 phishing campaign attributed to APT29 (Cozy Bear), as reported by Mandiant. The rule specifically looks for the creation or modification of files named 'ds7002.lnk', 'ds7002.pdf', or 'ds7002.zip'.
Detects suspicious activity where 'rundll32.exe' is used in the command line to invoke a '.sys' file. This behavior has been observed in attacks attributed to UNC2452 (NOBELIUM).
Page 3 of 3